You approve. PII rules apply before data lands.
rsync.ai is built for teams that have to trust a tool with production data. The design assumption is control, not autonomy: nothing syncs until you approve it, PII rules apply before data lands in the destination, and the code is yours to read.
You approve before anything runs
rsync.ai never starts a pipeline you haven't approved. It plans the sync, shows you the schema, sources, and PII rules, and waits for your confirmation before anything is created or run. If a request leaves something open, it stops and asks. The AI proposes; you decide what executes.
PII rules apply before data lands
Before a sync runs, rsync.ai scans columns for likely personal data — emails, phone numbers, IDs, addresses — and proposes a per-field action: mask, hash (SHA-256 or HMAC), drop, or pass-through. You review and approve the rules, and they apply before data lands in the destination. Your choices stay with the pipeline, so sensitive fields are handled the same way on every run. Detection is automated, so review what it flags.
Credentials encrypted at rest
Source and destination credentials are AES-256 encrypted at rest. On rsync.ai Cloud, rsync.ai holds the encryption key; when you self-host, you hold it. Credentials are used to run your pipelines and nothing else.
Generation that refuses to guess
When rsync.ai generates a connector from an API's docs, it discovers the protocol, auth, and operations from public sources — and refuses to ship anything it couldn't verify. No silently-wrong connectors writing to your data.
Separated by pipeline
Each pipeline writes into its own schema-qualified namespace in the destination, keeping every source's data separated.
Every run is traceable
Every run keeps its history and OpenTelemetry traces. Pipelines are durable Temporal workflows, so you can see each run, its row counts, and its errors when you need to audit what happened.
Source-available and self-hostable
rsync.ai's code is source-available under the rsync.ai Source-Available License, so your security team can read and audit exactly what runs against your data. You can run the full stack inside your own VPC with the install.sh script (github.com/rsync-ai/rsync.ai), which brings it up with Docker Compose, so source credentials, in-flight rows, and PII stay inside your network when you run Ollama as the model — or start on rsync.ai Cloud, which processes data under the safeguards above.
What we don't claim yet
rsync.ai is early. We haven't completed third-party attestations like SOC 2 or ISO 27001 — formal compliance and a detailed security whitepaper are on the path to general availability. SSO, SCIM, and customer-managed encryption keys (KMS/BYOK) are not built yet. If you need our full architecture review, data-flow diagrams, or a signed agreement to evaluate rsync.ai with production data, we'll walk your team through the specifics directly.